Flow classification and OOD data detection method, system and device and medium

Abstract

The invention provides a traffic classification and OOD data detection method, system and device and a medium, and belongs to the technical field of network security. The method comprises the following steps: segmenting original traffic into sessions, extracting traffic data from the sessions, converting the traffic data into a matrix, and generating a meta-training set and a meta-test set; generating a meta-task by randomly sampling the meta-training set, and outputting a corresponding support set, a query set and a tag set; performing feature extraction by using a convolutional neural network to obtain an embedded vector; calculating a prototype of each type of samples in the support set, and calculating a distance from each sample in the query set and the sample set to each prototype; according to the distance, optimizing model parameters through a loss function to generate a classification detection model; and carrying out feature extraction and distance calculation on the traffic data by using a classification detection model, and carrying out OOD data judgment and classification according to a threshold value. According to the invention, through improving the meta-learning framework, the model realizes rapid classification and OOD data detection of new types of traffic at the same time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically to a traffic classification and OOD data detection method, system, device and medium. Background Art

[0002] Network traffic classification has always been one of the hot topics in the field of network security research. Realizing rapid traffic classification and detecting unknown traffic in various scenarios is of great significance for preventing various network security threats such as network attacks, malware and transaction fraud.

[0003] Currently, there are three main solutions that can achieve rapid traffic classification and unknown traffic detection.

[0004] 1. Load-based methods mainly use the extracted port number for classification or use regular expressions to classify the payload of the data packet according to the specific pattern. The classification performance of this method will be significantly reduced when facing network address translation (NAT), protocol embedding, random port allocation or encrypted traffic.

[0005] 2. The statistical learning-based method mainly uses expert experience to manually select the feature set of traffic data, and then uses traditional machine learning methods such as Naive Bayes, SVM, random forest, etc. for classification. Although this method has a certain degree of improvement in classification effect, it is heavily dependent on expert experience and has poor adaptability to different types of traffic and classification standards of different granularities. At the same time, it also has certain difficulties when facing problems such as imbalanced categories in the data and poor model transfer learning ability.

[0006] 3. Based on deep learning methods, CNN or LSTM methods are used to extract features from raw traffic data to form embedded vectors, which are then classified using a fully connected layer. Deep learning-based methods avoid the trouble of manually selecting feature sets, but such models often require a large amount of labeled new types of traffic for retraining or incremental training when encountering new types of traffic, which makes it impossible for the model to quickly classify new types of traffic in real time and also causes consumption of computing resources. In addition, in real scenarios, problems such as changes in traffic properties over time or Out-Of-Distribution (OOD, i.e. new types of data that do not appear in the training set or sample library) often occur, which also reduces the adaptability of such models. Summary of the invention

[0007] In view of the above problems, the purpose of the present invention is to provide a traffic classification and OOD data detection method, system, device and medium. By improving the meta-learning framework, the model can simultaneously realize the rapid classification of new types of traffic and OOD data detection.

[0008] In order to achieve the above object, the present invention is implemented through the following technical solutions: In a first aspect, the present invention discloses a traffic classification and OOD data detection method, comprising the following steps: S1: Divide the original traffic into sessions, extract a preset amount of traffic data from the sessions, convert it into a matrix, and generate a meta-training set and a meta-test set; S2: Generate meta-tasks by randomly sampling the meta-training set and output the corresponding support set, query set, and label set; S3: Based on the meta-task, a convolutional neural network is used to extract features and obtain an embedding vector. S4: Calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and sample set to each prototype; S5: Optimizing model parameters through a loss function according to the distance to generate a classification detection model; S6: Apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be detected, and perform OOD data judgment and classification based on the threshold.

[0009] Further, the step S1 comprises: Split the original traffic into multiple sessions; Capture the beginning of each session packets and extract the first bytes; Convert each byte of data into The numerical data is converted into a flow data matrix; The traffic data matrix is ​​recorded as ,in and They represent traffic samples and corresponding labels respectively; Will Meta-training set and meta-test set ; Among them, the meta-training set and meta-test set Samples in the meta-test set The label set contains several meta-training sets The tag is not contained in the tag set.

[0010] Further, the step S2 comprises: From the meta-training set Collection of tags Randomly select Classes form a class subset ,in, Less than The total number of categories in ; For a subset of categories Each category in the meta-training set Randomly select samples, and divide them into samples and samples are added to the support set and queryset middle; In the label collection Remove a subset of categories from Elements of the tag collection Extract several tags from the OOD tag set ; According to OOD tag collection All categories in the meta-training set Extract samples, forming an OOD sample set ; Output a meta-task and the corresponding support set , query set And OOD sample collection .

[0011] Further, the step S3 comprises: Will support set , query set And OOD sample collection Input the four first-class convolution Blocks I of the convolutional neural network for feature extraction to generate the first feature map; The first feature map is input into two second-class convolution Block IIs of the convolutional neural network for feature extraction to generate a target feature map; The target feature map is expanded to generate a high-dimensional vector for each sample, and the high-dimensional vector is input into the fully connected layer of the convolutional neural network to obtain the embedding vector of each sample .

[0012] Further, the step S4 comprises: Embedding vector based on each sample , through the formula Calculate the prototype of the k-th class sample to generate the support set The prototype of each type of sample in ; To support the set Middle A collection of class samples, Indicates the number of elements in the collection; The query set is calculated according to the following formula And OOD sample collection The embedding vector corresponding to each sample in Distance :

[0013] in, yes or The index of the sample in , It is The weight factor of each dimension; The weight vector ;in, is a trainable matrix, is the softmax operation, It is the concatenation operation of vectors; According to the formula Compute query sets Medium Sample The probability distribution of .

[0014] Further, the step S5 comprises: Calculate query sets separately The naive classification loss for each sample in and marginal loss ; in, , , is a first preset threshold; According to the formula Calculate OOD sample set The marginal loss for each sample in ;in is a second preset threshold; According to the formula Calculate the total loss ; Based on the total loss Determine whether the loss has converged; if so, configure the model parameters and generate a classification detection model.

[0015] Further, the step S6 comprises: Obtain a meta-test set or traffic data to be tested as the data to be tested; Based on the data to be tested, generate corresponding meta-tasks according to step S2; Input the meta-task into the classification detection model, perform feature extraction and distance calculation, and generate the distance D from each sample in the corresponding query set to each prototype; Determine whether D>determination threshold Th; if so, classify the corresponding sample as DOO; if not, select the category of the prototype corresponding to the distance D as the predicted category of the sample.

[0016] In a second aspect, the present invention further discloses a traffic classification and OOD data detection system, comprising: The data preprocessing module is used to divide the original traffic into sessions, extract a preset amount of traffic data from the sessions, convert it into a matrix, and generate a meta-training set and a meta-test set; The meta-task generation module is used to generate meta-tasks by randomly sampling the meta-training set and output the corresponding support set, query set and label set; The feature extraction module is used to extract features based on meta-tasks using convolutional neural networks to obtain embedded vectors; The prototype and distance calculation module is used to calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and sample set to each prototype; A loss calculation and training module, used to optimize model parameters through a loss function according to the distance to generate a classification detection model; The meta-test module is used to apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be tested, and to determine and classify OOD data according to the threshold.

[0017] In a third aspect, the present invention further discloses a traffic classification and OOD data detection device, comprising: A memory for storing traffic classification and OOD data detection programs; A processor is used to implement the steps of the traffic classification and OOD data detection method as described in any one of the above items when executing the traffic classification and OOD data detection program.

[0018] In a fourth aspect, the present invention further discloses a readable storage medium, on which a traffic classification and OOD data detection program is stored. When the traffic classification and OOD data detection program is executed by a processor, the steps of the traffic classification and OOD data detection method as described in any one of the above items are implemented.

[0019] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention discloses a method, system, device and medium for traffic classification and OOD data detection, and constructs a classification detection model by improving the meta-learning framework, so that the model can simultaneously realize the rapid classification of new types of traffic and OOD data detection. After the meta-training stage of the classification detection model is completed, when encountering a new type of traffic, there is no need to retrain. Only a small amount of annotation of the new type of traffic is required, and it is directly put into the support set to classify the new type of traffic. This avoids the labor cost and consumption of computing resources caused by a large amount of annotation.

[0020] In practical applications, even if you suddenly encounter a category that has never been labeled in the sample library or data that has not been labeled in time, the present invention can quickly identify it as OOD data. This avoids the misclassification of the model caused by the sudden appearance of OOD data in real scenes. In addition, the preprocessing method used by the classification detection model and the three-dimensional convolution structure in the feature extraction process fully retain the temporal characteristics of the data so that the model can obtain more effective representation; the present invention uses a unique distance calculation method to improve the model's ability to utilize data and improve the classification performance and stability of the model.

[0021] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0023] Figure 1 It is a method flow chart of a specific implementation mode of the present invention.

[0024] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0025] In the figure, 1. Data preprocessing module; 2. Meta-task generation module; 3. Feature extraction module; 4. Prototype and distance calculation module; 5. Loss calculation and training module; 6. Meta-test module. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] This embodiment provides a method for traffic classification and OOD data detection, which is mainly divided into data preprocessing, meta-training and meta-testing stages. The meta-training stage includes meta-task generation, feature extraction, prototype calculation and distance calculation, loss calculation and training, and the meta-testing stage includes meta-task generation and using the trained model to obtain distance and OOD judgment and classification. Figure 1 As shown, the method comprises the following steps: S1: Divide the original traffic into sessions, extract a preset amount of traffic data from the sessions and convert it into a matrix, and generate a meta-training set and a meta-test set.

[0028] In a specific implementation, first, the original traffic is divided into sessions; second, the front of each session is intercepted. packages and the first bytes, converting each byte of data into The value of , and then the intercepted data is converted into a matrix. Among them, is a square number. If the number of sessions and the length of the packet are insufficient, zero padding is performed. Finally, the matrix is ​​rearranged as The traffic data matrix.

[0029] At this time, after the above processing, the flow data can be written as:

[0030] in, and They represent traffic samples and corresponding labels respectively.

[0031] Then, Divided into two parts: meta-training set and meta-test set It should be noted that when dividing the data set, it is necessary to ensure that the meta-training set and meta-test set In addition to ensuring that the samples in the meta-test set do not overlap, The label set contains several meta-training sets The tag is not included in the tag collection.

[0032] S2: Generate meta-tasks by randomly sampling the original training set and output the corresponding support set, query set, and label set.

[0033] In a specific implementation, the purpose of this step is to generate a meta-task, which specifically includes the following sub-steps: S201: From the meta-training set The category set (i.e. label set) of Randomly select Classes form a class subset ,in, Smaller than the meta-training set The total number of categories in .

[0034] S202: For a subset of categories Each category is from Random draw samples, and split them into two parts, each containing and samples are added to the support set and queryset middle.

[0035] S203: First, in the category collection Remove a subset of categories from elements, and then from the category set Extract several tags from the OOD tag set .

[0036] S204: OOD tag set All categories in the meta-training set Extract samples, forming an OOD sample set .

[0037] S205: Output a support set corresponding to a meta-task , query set And OOD sample collection .

[0038] S3: Based on the meta-task, a convolutional neural network is used to extract features and obtain an embedding vector.

[0039] In a specific implementation, the purpose of this step is to perform feature extraction. The feature extraction process is as follows: S301: Let support set , query set And OOD sample collection They are respectively passed through 4 first-class convolution Block I. Block I consists of an output channel of 128 and a convolution kernel size of , a three-dimensional convolution layer with a stride of 1, a three-dimensional normalization layer BatchNorm3D and a ReLU activation function layer.

[0040] S302: Let the output result of step S301 enter two second-class convolution Block II, where Block II consists of a convolution kernel with an output channel of 64 and a size of , a 3D convolutional layer with a stride of 1, a 3D normalization layer BatchNorm3D, a ReLU activation function layer, and a The pooling layer composition.

[0041] S303: Expand the result outputted in step S302, and obtain a high-dimensional vector for each sample; input these vectors into a fully connected layer, and obtain an embedding vector for each sample .

[0042] S4: Calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and sample set to each prototype.

[0043] In a specific implementation, the purpose of this step is to realize prototype calculation and distance calculation, and the specific steps are as follows: S401: After feature extraction, the support set The embedding vectors of the samples in the above example are used to calculate prototypes, one prototype for each class. The prototype calculation method of class samples is ,in for Middle A collection of class samples. Indicates the number of elements in a collection.

[0044] S402: Calculate query set And OOD sample collection The embedding vector corresponding to each sample in The calculation method is: .in, yes or The index of the sample in . It is The weight factor of the dimension is also the weight vector No. components. Weight vector ,in represents the trainable matrix, represents the softmax operation, Represents a vector concatenation operation.

[0045] S403: Calculate query set Medium Sample The probability distribution of .

[0046] The calculation method is .

[0047] S5: According to the distance, optimize the model parameters through the loss function to generate a classification detection model.

[0048] In a specific implementation, this step implements loss calculation and model training, and finally generates a classification detection model. Specifically, it includes the following sub-steps: S501: Calculate query sets separately The naive classification loss for each sample in and marginal loss .

[0049] in, , , is a threshold value.

[0050] S502: According to the formula Calculate OOD sample set The marginal loss for each sample in ;in is a threshold value.

[0051] S503: According to the formula Calculate the total loss .

[0052] S504: Back propagate to find the gradient, and then the gradient will decrease.

[0053] It should be noted that the above four processes from step S2 to step S5 are performed several times until the loss converges. After the loss converges, the model parameters can be configured and a classification detection model after training is generated.

[0054] S6: Apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be detected, and perform OOD data judgment and classification based on the threshold.

[0055] In a specific implementation, this step implements meta-testing, which can be performed on the meta-test set Model testing can also be performed on real-time data to determine and classify OOD data.

[0056] The specific steps include the following: S601: Get meta-test set Or the flow data to be detected is used as the data to be tested.

[0057] S602: Based on the data to be tested, perform the meta-task generation process of step S2; then use the trained parameters to perform the feature extraction of step S3 and the prototype calculation and distance calculation of step S4 to obtain each sample in the query set. Distance to each prototype . Take the distance to the nearest prototype .

[0058] S603: Set a threshold ,if Greater than , then Classify as OOD, otherwise select The category corresponding to the prototype is The predicted category.

[0059] The present invention provides a method for traffic classification and OOD data detection. Through sophisticated data preprocessing, innovative meta-training (including meta-task generation, efficient feature extraction, prototype and distance calculation, and comprehensive loss calculation and model training) and flexible meta-testing strategies, it achieves accurate classification of traffic data and efficient OOD detection under limited samples, significantly improving the model's generalization ability and recognition accuracy for new categories of traffic.

[0060] See also Figure 2 As shown, the present invention also discloses a traffic classification and OOD data detection system, including: a data preprocessing module 1, a meta-task generation module 2, a feature extraction module 3, a prototype and distance calculation module 4, a loss calculation and training module 5 and a meta-test module 6. The data preprocessing module 1 is used to divide the original traffic into sessions, extract a preset amount of traffic data from the sessions and convert them into matrices, and generate a meta-training set and a meta-test set.

[0061] The meta-task generation module 2 is used to generate meta-tasks by randomly sampling the meta-training set, and output the corresponding support set, query set and label set.

[0062] The feature extraction module 3 is used to extract features based on the meta-task using a convolutional neural network to obtain an embedding vector.

[0063] The prototype and distance calculation module 4 is used to calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and the sample set to each prototype.

[0064] The loss calculation and training module 5 is used to optimize the model parameters through the loss function according to the distance to generate a classification detection model.

[0065] The meta-test module 6 is used to apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be detected, and to perform OOD data determination and classification according to the threshold.

[0066] The specific implementation of the traffic classification and OOD data detection system of this embodiment is basically consistent with the specific implementation of the above-mentioned traffic classification and OOD data detection method, and will not be repeated here.

[0067] The present invention also discloses a traffic classification and OOD data detection device, comprising a processor and a memory; wherein, when the processor executes the traffic classification and OOD data detection program stored in the memory, the steps of the traffic classification and OOD data detection method as described in any one of the above items are implemented.

[0068] Furthermore, the traffic classification and OOD data detection device in this embodiment may also include: The input interface is used to obtain the traffic classification and OOD data detection program imported from the outside, and save the obtained traffic classification and OOD data detection program to the memory. It can also be used to obtain various instructions and parameters transmitted by external terminal devices, and transmit them to the processor so that the processor can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0069] The output interface is used to output various data generated by the processor to the terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor. In this embodiment, the output interface may specifically include but is not limited to a USB interface, a serial interface, etc.

[0070] The communication unit is used to establish a remote communication connection between the traffic classification and OOD data detection device and the external server so that the traffic classification and OOD data detection device can mount the image file to the external server. In this embodiment, the communication unit may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0071] The keyboard is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0072] The display is used to display the relevant information of the traffic classification and OOD data detection process in real time.

[0073] The mouse can be used to assist users in inputting data and simplify user operations.

[0074] The present invention also discloses a readable storage medium, wherein the readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable hard disk, a CD-ROM or any other form of storage medium known in the technical field. The readable storage medium stores a flow classification and OOD data detection program, and when the flow classification and OOD data detection program is executed by a processor, the steps of the flow classification and OOD data detection method described in any one of the above items are implemented.

[0075] In summary, the present invention improves the meta-learning framework so that the model can simultaneously achieve rapid classification of new types of traffic and OOD data detection.

[0076] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0077] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0078] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0079] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0080] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0081] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0082] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0083] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0084] The above is a detailed introduction to the traffic classification and OOD data detection method, system, device and readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A traffic classification and OOD data detection method, characterized in that: The steps include: S1: Divide the original traffic into sessions, extract a preset amount of traffic data from the sessions, convert it into a matrix, and generate a meta-training set and a meta-test set; S2: Generate meta-tasks by randomly sampling the meta-training set and output the corresponding support set, query set, and label set; S3: Based on the meta-task, a convolutional neural network is used to extract features and obtain an embedding vector. S4: Calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and sample set to each prototype; S5: Optimizing model parameters through a loss function according to the distance to generate a classification detection model; S6: Apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be detected, and perform OOD data judgment and classification based on the threshold.

2. The method for traffic classification and OOD data detection according to claim 1, characterized in that: The step S1 comprises: Split the original traffic into multiple sessions; Capture the beginning of each session packets and extract the first bytes; Convert each byte of data into The numerical data is converted into a flow data matrix; The traffic data matrix is ​​recorded as ,in and Represent traffic samples and corresponding labels respectively; Will Meta-training set and meta-test set ; Among them, the meta-training set and meta-test set Samples in the meta-test set The label set contains several meta-training sets The tag is not contained in the tag set.

3. The method for traffic classification and OOD data detection according to claim 2, characterized in that: The step S2 comprises: From the meta-training set Collection of tags Randomly select Category subsets ,in, Less than The total number of categories in ; For a subset of categories Each category in the meta-training set Randomly select samples, and divide them into samples and samples are added to the support set and queryset middle; In the label collection Remove a subset of categories from Elements of the tag collection Extract several tags from the OOD tag set ; According to OOD tag collection All categories in the meta-training set Extract samples, forming an OOD sample set ; Output a meta-task and the corresponding support set , query set And OOD sample collection .

4. The method for traffic classification and OOD data detection according to claim 3, characterized in that: The step S3 comprises: Will support set , query set And OOD sample collection Input the four first-class convolution Blocks I of the convolutional neural network for feature extraction to generate the first feature map; The first feature map is input into two second-class convolution Block IIs of the convolutional neural network for feature extraction to generate a target feature map; The target feature map is expanded to generate a high-dimensional vector for each sample, and the high-dimensional vector is input into the fully connected layer of the convolutional neural network to obtain the embedding vector of each sample .

5. The method for traffic classification and OOD data detection according to claim 4, characterized in that: The step S4 comprises: Embedding vector based on each sample , through the formula Calculate the prototype of the k-th class sample to generate the support set The prototype of each type of sample in ; To support the set Middle A collection of class samples, Indicates the number of elements in the collection; The query set is calculated according to the following formula And OOD sample collection The embedding vector corresponding to each sample in Distance : in, yes or The index of the sample in , It is The weight factor of each dimension; According to the formula Compute query sets Medium Sample The probability distribution of .

6. The method for traffic classification and OOD data detection according to claim 5, characterized in that: The step S5 comprises: Calculate query sets separately The naive classification loss for each sample in and marginal loss ; in, , , is a first preset threshold; According to the formula Calculate OOD sample set The marginal loss for each sample in ;in is a second preset threshold; According to the formula Calculate the total loss ; Based on the total loss Determine whether the loss has converged; if so, configure the model parameters and generate a classification detection model.

7. The method for traffic classification and OOD data detection according to claim 6, characterized in that: The step S6 comprises: Obtain a meta-test set or traffic data to be tested as the data to be tested; Based on the data to be tested, generate corresponding meta-tasks according to step S2; Input the meta-task into the classification detection model, perform feature extraction and distance calculation, and generate the distance D from each sample in the corresponding query set to each prototype; Determine whether D>determination threshold Th; if so, classify the corresponding sample as DOO; if not, select the category of the prototype corresponding to the distance D as the predicted category of the sample.

8. A traffic classification and OOD data detection system, characterized in that: The system adopts the traffic classification and OOD data detection method as described in any one of claims 1 to 7; The system comprises: The data preprocessing module is used to divide the original traffic into sessions, extract a preset amount of traffic data from the sessions, convert it into a matrix, and generate a meta-training set and a meta-test set; The meta-task generation module is used to generate meta-tasks by randomly sampling the meta-training set and output the corresponding support set, query set and label set; The feature extraction module is used to extract features based on meta-tasks using convolutional neural networks to obtain embedded vectors; The prototype and distance calculation module is used to calculate the prototype of each type of sample in the support set, and calculate the distance from each sample in the query set and sample set to each prototype; A loss calculation and training module, used to optimize model parameters through a loss function according to the distance to generate a classification detection model; The meta-test module is used to apply the classification detection model to perform feature extraction and distance calculation on the meta-test set or the traffic data to be tested, and to determine and classify OOD data according to the threshold.

9. A flow classification and OOD data detection device, characterized in that: include: A memory for storing traffic classification and OOD data detection programs; A processor, configured to implement the steps of the traffic classification and OOD data detection method as described in any one of claims 1 to 7 when executing the traffic classification and OOD data detection program.

10. A readable storage medium, characterized in that: The readable storage medium stores a traffic classification and OOD data detection program, which, when executed by a processor, implements the steps of the traffic classification and OOD data detection method as described in any one of claims 1 to 7.

Images